What if in big application,we use something like below in multiple areas
<button type="button" class="btn btn-primary" onclick="func1()">test</button>
<script>
function somefunction(){
//some function task
}
</script>
Couple of doubts:
1. For inline scripts like <script></script>, can we use either nonce or hash ?
Or is there some factors to consider when to opt for nonce and when to opt for hash?
2. For inline events, there is a scenario where we cant change to addeventlistener everywhere in our application. So, is it okay if we implement either hash/nonce for inline script and ignore inline events with unsafe-hashes, Basically below combinations would allow scripts and events both right?
CSP: script-src ‘nonce’ ‘unsafe-hashes’
CSP: script-src ‘sha-something’ ‘unsafe-hashes’
Note: we are not considering to use ‘unsafe-inline’
4